Web access

web_fetch retrieves a URL and reduces it to clean Markdown (a readability pass extracts the main article, then converts to Markdown) — no key required. It’s SSRF-guarded: only http/https, localhost and private/loopback/link-local addresses are blocked (including the cloud-metadata endpoint 169.254.169.254), redirects are re-validated per hop, and the connection is pinned to the validated IP. LUXE_WEB_ALLOW_PRIVATE=1 is an explicit opt-out for intentional internal fetches. A GitHub repo URL is shallow-cloned into .luxe/gh-cache/ and its path returned so the agent can read/grep/glob the real files; a blob URL fetches the raw file.

web_search works out of the box — no key, no account, no configuration. It falls back to Exa’s public MCP endpoint, so a fresh install can research immediately. Set BRAVE_API_KEY, TAVILY_API_KEY, or EXA_API_KEY to route through that vendor instead; an explicit key always wins.

Results carry the relevant passage from each page, not just a snippet — so the model can usually answer without a follow-up web_fetch. Returning bare links is what turns one research question into six round-trips. Searches also take several query phrasings at once, plus domain and recency filters:

{
  "queries": ["tokio 1.48 release notes", "tokio 1.48 breaking changes"],
  "domains": ["github.com", "-pinterest.com"],   // '-' excludes
  "recency": "month",
  "n": 5
}

Output is compact markdown, capped like every other search tool. To check the live endpoint’s response shape after an upstream change:

LUXE_TEST_LIVE_WEB=1 cargo test -p luxe-tools --test live_exa_mcp -- --nocapture