Brave Search MCP

Brave Search MCP scores 83/100 because it retrieves current web evidence efficiently across eight search modes and gives unusually strong control over LLM-ready context. The score is held back by cost containment, historical request amplification, and the security implications of placing large amounts of untrusted web content into an agent that may also control other tools.

Brave Search MCP is Brave Software’s official Model Context Protocol server for exposing Brave Search API capabilities as tools that an AI agent can call.

The server does not operate a separate search index. It translates MCP tool calls into Brave Search API requests and returns structured search results or extracted source context to the client.

The current first-party package is @brave/brave-search-mcp-server. It replaces the deprecated reference package @modelcontextprotocol/server-brave-search.

Brave Search MCP works by converting an MCP tool call into a Brave Search API request and returning the result to the model as search data, summaries or extracted LLM-ready context.

This architecture separates three costs: the MCP tool schema, the Brave Search API request, and the model tokens consumed by the returned content. They should not be collapsed into one “MCP cost” number.

Brave Search MCP wraps Brave Search API functions in an agent-native tool interface, while the Brave Search API exposes the same underlying search services directly to application code.

Brave Search MCP exposes eight tools covering the web, news, images, video, local businesses, places, search summaries and LLM-ready source context.

brave_llm_context can replace part of the usual search → open → extract pipeline by returning pre-extracted webpage content directly for AI grounding.

A normal retrieval chain often requires several tool calls:

LLM Context compresses that workflow into a search-and-extraction step and exposes explicit budgets for the returned evidence.

Brave Search MCP has three separate token costs: tool-schema overhead, returned search/context payloads, and the model’s own response tokens. The Brave Search API charge is separate because it is billed per request rather than per model token.

1. Tool-schema overhead

The eight current tool schemas are estimated at ~4K–7K tokens when all tools are exposed to the model. The exact count depends on the MCP client, schema serialization and model tokenizer. An exact implementation should capture the live tools/list payload and count it with the target model’s tokenizer.

2. Result overhead

Ordinary web/news/image/video/local results vary with result count and selected fields. brave_llm_context is the largest predictable result surface because it exposes an explicit total budget from 1,024 to 32,768 tokens.

3. Model output

Search results become input to the model, and the model’s answer adds separate output tokens. Reasoning tokens, cached-input behavior and long-context surcharges depend on the chosen provider/model.

Model-window sources checked Sep 27, 2026: OpenAI model/pricing docs; Anthropic model docs; Google Gemini 3.8 Flash docs; xAI model/pricing docs; Mistral model docs. Percentages are arithmetic shares of documented context windows, not tokenizer measurements of the Brave tool schemas.

The context window is not the bill

A 39.8K starting load can be a small percentage of a 1M-token model and still create meaningful recurring cost when an agent performs many searches. Conversely, a lower-cost model can make the model bill tiny while the Brave API request charge becomes the dominant recurring cost.

The MCP server is open-source, while Brave Search API usage and the AI model are billed separately.

Brave Search API cost

Current Search pricing is $5 per 1,000 requests, or about $0.005 per search, with $5 in monthly credits. At the Search rate, the recurring credit covers roughly 1,000 requests before additional usage charges.

The table below uses 40K input + 8K output tokens. The final column adds $0.10 for 20 billed Brave Search requests before monthly credits. It does not include caching discounts, long-context premiums, reasoning-specific billing, regional premiums or other provider-specific modifiers.

Pricing sources checked Sep 27, 2026: OpenAI API pricing; Anthropic Fable 5.1 model comparison; Google Gemini 3.8 Flash docs; xAI pricing; Mistral pricing. The 20-search Brave component assumes $5/1,000 Search requests. Actual endpoint billing can differ by Brave API plan and tool.

What dominates the cost?

For expensive models, model tokens can dominate a small research run. For low-cost models or high-volume automation, the Brave API charge can dominate. A 1,000-search-per-day agent reaches about 30,000 searches/month ≈ $150/month before the recurring credit, even if the model itself is inexpensive.

Brave Search MCP is read-only for search data, but its main risks are API-key exposure, paid-query amplification, untrusted webpage content and unsafe HTTP deployment.

The server has no destructive external write tools. Scan Grade C reflects executable Node code, external network access, a paid API credential and optional HTTP exposure rather than filesystem or account-write authority.

API-key handling

The server accepts BRAVE_API_KEY and also supports BRAVE_API_KEY_FILE. File-based secrets are preferable for persistent Docker or secret-mounted deployments.

HTTP exposure

HTTP mode binds to 127.0.0.1 by default. Changing the bind address can make the endpoint network-accessible, but the MCP HTTP endpoint does not provide its own application-level authentication. Public exposure therefore requires an external authenticated boundary.

DNS-rebinding hardening

The current server supports allowed Origins, allowed Hosts, loopback defaults and explicit rebinding defenses.

Yes. brave_llm_context can place tens of thousands of tokens from untrusted webpages directly into model context, increasing prompt-injection exposure compared with short search snippets.

The Brave server itself remains read-only, which limits direct damage. The more important risk appears when the same AI client also controls write-capable MCPs such as GitHub, Slack, filesystem, email, browser automation or payment systems.

Search content is evidence, not trusted instruction.

No active MCP-specific anonymous telemetry pipeline was found in the evaluated open-source implementation.

Normal search requests still go to Brave Search API and are subject to Brave’s API service and data policies. API traffic and a dedicated MCP analytics pipeline are different concepts.

Not yet under the MCPVerdict compatibility rule used for this evaluation. The evaluated package still uses @modelcontextprotocol/sdk 1.30.0 rather than the v2/current-protocol line.

Stateless HTTP support is a positive compatibility signal, but it is not enough by itself to establish full July 2026 protocol adoption.

Brave Search MCP works with clients that can launch a local STDIO server or connect to a compatible Streamable HTTP endpoint.

To install Brave Search MCP, run Brave’s official npm package from the MCP client and provide a valid Brave Search API key.

{
  "mcpServers": {
    "brave-search": {
      "command": "npx",
      "args": [
        "-y",
        "@brave/brave-search-mcp-server",
        "--transport",
        "stdio"
      ],
      "env": {
        "BRAVE_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

The current official package is @brave/brave-search-mcp-server. The old @modelcontextprotocol/server-brave-search reference package is deprecated for this profile.

How to verify the connection

1. Restart or reload the MCP client after changing configuration.
2. Confirm the Brave server starts without an API-key error.
3. Confirm the expected eight tools appear.
4. Run one small brave_web_search request.
5. Run one brave_llm_context request with a low context cap before increasing the budget.

Brave Search MCP does not provide one shared public MCP URL; STDIO needs no URL, while HTTP mode exposes an endpoint on the machine running the server.

The current HTTP defaults are 127.0.0.1 on port 8080. Binding to loopback keeps the endpoint local. A remote deployment needs a deliberate bind address, network controls and external authentication.

Brave Search MCP has seven practical limitations: metered API usage, request amplification, large-context cost, prompt-injection exposure, API-plan constraints, search incompleteness and no interactive browser control.

• Metered API usage: every search can consume paid quota.
• Request amplification: one task can generate several parallel or batched searches.
• Large-context cost: a 32K LLM Context response still consumes model input tokens.
• Prompt injection: extracted webpage text is untrusted external content.
• API-plan constraints: some richer local capabilities depend on account access.
• Search incompleteness: ranked results are evidence, not exhaustive truth.
• No browser interaction: the server cannot click, type, log in or operate web applications.

Brave Search MCP is primarily a search and retrieval server, so its closest comparisons are search/research tools rather than browser-automation tools.

Brave Search MCP vs browser automation

Use Brave Search MCP to find information; use browser automation to interact with a webpage. Search is more efficient for discovery and grounding, while Playwright-style tools are required for login, clicking, forms and application workflows.

Brave Search MCP usually fails because of an invalid API key, unavailable API quota, an incorrect package, a missing Node runtime or an HTTP networking configuration problem.

The server does not start

1. Confirm Node.js and npx are available to the MCP client.
2. Use @brave/brave-search-mcp-server.
3. Confirm the client can reach npm during package retrieval.
4. Restart the client after configuration changes.

The tools load but search fails

1. Verify BRAVE_API_KEY or BRAVE_API_KEY_FILE.
2. Check that the key is active and the account has available API usage.
3. Confirm the requested endpoint is available on the current Brave API plan.

HTTP works locally but not remotely

Check the bind address, port, firewall, reverse proxy, allowed Hosts/Origins and authentication layer. The default loopback binding intentionally prevents remote access.

Run Brave Search MCP locally over STDIO, expose only web search and LLM Context, cap LLM Context around 4K tokens, and compare the same research questions against the search already available in the AI client.

A useful test sequence is:

1. ordinary web query;
2. breaking-news query;
3. freshness-restricted query;
4. local business query;
5. place query;
6. image query;
7. video query;
8. brave_llm_context at 4K;
9. the same LLM Context query at a larger budget;
10. summarizer;
11. controlled parallel calls to observe quota behavior.

Twenty billed Search requests cost about $0.10 before monthly credits.

Brave Search MCP is a strong first-party search MCP because it combines broad vertical coverage with explicit freshness and context controls while keeping the external tool surface read-only.

The main reason to use it is not simply “Brave search inside Claude or another client.” The more important capability is brave_llm_context: an agent can retrieve current evidence and bound how much extracted source content enters the model without adding a separate fetch/extraction tool.

The main weakness is operational economics. Search is safe from destructive writes, but every request can cost money. Historical batch amplification and ordinary model parallelism show why an autonomous search agent needs explicit request budgets rather than unlimited tool approval.

Why it scores well

• first-party Brave maintenance;
• eight focused read-only tools;
• dedicated news, image, video, local and place search;
• strong freshness controls;
• bounded LLM-ready extracted context;
• low tool-count/schema complexity;
• STDIO and HTTP deployment options;
• API-key file support and HTTP hardening.

Why it does not score higher

• paid requests create recurring operational cost;
• parallel/batched calls can amplify spend;
• LLM Context imports untrusted webpage content;
• HTTP has no built-in application authentication when network-exposed;
• rigorous independent MCP-specific search-quality benchmarks are still missing;
• full July 2026 MCP adoption is incomplete under the current compatibility rule.

Bottom line

Brave Search MCP is most useful when an agent needs current, bounded web evidence without operating a browser—and when API request budgets are treated as a first-class part of the deployment.

The evidence set supports active maintenance and meaningful security improvements, but it also documents real cost-containment and interoperability problems.