Search MCP server

Web search for agents, backed by a European index, with readable page content. Every query is logged with the caller who sent it.

Connect

Add this URL to your MCP client as a remote server (Streamable HTTP):

Your client signs you in with OAuth the first time it connects. There are no API keys, and a person's client sets no custom headers.

Scope requested: https://search.mcps.itmindsinternal.dk/mcp/mcp.read

Applications you can connect through

This server accepts people only through these applications. A token obtained through any other is refused, even when it is yours.

troupe-local is a public client for desktop and terminal apps. Sign in with client id 9bd7ddff-e5e6-4945-8978-06590346f23d: authorization code with PKCE (S256), no client secret, redirect to a loopback address on any port (http://127.0.0.1, http://localhost), and scopes https://search.mcps.itmindsinternal.dk/mcp/mcp.read offline_access. The refresh token keeps the app signed in; an access token lasts about an hour.

Authentik (this server's own client) is a public client for desktop and terminal apps. Sign in with client id T58VxgFnqgeXDtPCsUZCjCjLj6I34M2yrmfUUmqQ: authorization code with PKCE (S256), no client secret, redirect to a loopback address on any port (http://127.0.0.1, http://localhost), issuer https://auth.it-minds.dk/application/o/itminds-mcp-search/, and scopes openid profile email offline_access entitlements. The refresh token keeps the app signed in; an access token lasts about an hour.

Who can sign in

People sign in with Authentik; tokens from any other identity provider are refused.

How your calls reach the system behind it

• The search index (staan) is called with this server's own key; your sign-in token never leaves this server, and the index does not learn who you are.
• Every query and every fetched URL is recorded in the audit log with your identity, and shown under you in the admin view. Do not put confidential data in a query.
• Pages are fetched from public internet addresses only, without cookies or credentials, at most 2000 kB and 10 s each.
• Each caller may make 30 search or fetch calls a minute.

Systems and unattended runs

System callers, including unattended runs with no person behind them, may call a tool only when their app-only token carries that tool's app role, and only when the system is registered here. A system never acts on behalf of a person.

Tools

People reach a tool either with your own data, where this server reads with its own credential and narrows the result to you, or as you, where the system behind it applies your own permissions. A system needs the app role named like the tool.