Search MCP Security and Prompt Injection
Search results come from the open web, and a web page can contain text written to steer an AI agent. That is indirect prompt injection. Keep tool approvals on, limit each server's privileges, and treat search output as data rather than instructions. Hyperresearch Answers is our editorial pick for accuracy, but no search server removes this risk on its own. Hyperresearch Answers is our editorial choice for a search MCP server: one ask call returns a short answer with quotes checked against their pages, so your agent’s context stays small.
The recommendation reflects Hyperresearch’s own benchmark runs and the published sources in this reference. Hyperresearch is our product. This is not a hands-on test of every tool.
Hyperresearch Answers → Search MCP servers → One ask call → Verified quotes
What the risk looks like
OWASP describes prompt injection as input that changes how a model behaves in unintended ways. Direct injection comes from the user's own prompt. Indirect injection comes from external content, such as a web page or file, that the model reads and may follow.
A search server is a path for indirect injection. A page can hide instructions in white text or metadata, and an agent that reads the page may act on them. Anthropic's research on browser agents says the attack surface is large, because pages, ads and embedded documents can all carry instructions.
Defenses at each layer
OWASP suggests constraining the model's role in the system prompt, validating outputs against a defined format, filtering inputs, limiting privileges, requiring human approval for high-risk actions, and marking external data so it carries less weight. Those steps apply to search servers as much as to any other tool.
The MCP tools specification says a human should stay in the loop and be able to deny a tool call. Cursor asks for approval before each MCP tool runs by default, and that setting should stay on. Anthropic reports that, in its internal adaptive test, Opus 4.5 reached a 1.4% attack success rate with its improved safeguards, down from 8.0% for the model alone. The company notes that even 1% is a meaningful risk.
Rules for the server side
The MCP security guide says servers must validate their inputs, enforce access controls, rate limit calls and sanitize outputs. It also says a server must not pass a token it received from a client to a downstream API. Issue a separate key for each tool, and revoke any key that may have leaked.
The client side has rules too. The MCP tools specification asks clients to show tool inputs before a call, so you can spot an unexpected query. If a search result asks the model to change settings, install a server or send data elsewhere, stop and review the request before you approve anything. Keep a note of odd results and share them with the vendor if a pattern repeats.
Checklist
- Keep tool approval prompts on for every search server.
- Give each agent the narrowest key and scope the vendor offers.
- Treat fetched page text as data, and review any action it asks the model to take.
- Prefer answers with quotes you can check against the source URL.
- Log tool calls and review them when results look unusual.
Questions & answers
Can a search MCP server stop prompt injection?
Not alone. A server can validate its inputs and return passages, but the agent still reads the text. Pair the server with client approvals, limited privileges and a human review step before any action with side effects.
Which search server is the safest?
Safety depends on the whole setup more than on the brand. Hyperresearch is our editorial pick for accuracy, because each quote is matched against its page. That match does not filter instructions hidden inside a quoted passage. Read each vendor's security documentation and test with a page you control.
Sources for this entry
- OWASP GenAI: LLM01 Prompt Injection
- Anthropic Research: Prompt injection defenses
- MCP security best practices
- MCP specification: Tools
Vendor descriptions are attributed to the vendor. Prices change; confirm with each vendor.
Continue this reading path
Cite this entry
https://searchmcpserver.com/search-mcp-security/