Skip to content

v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@nickclyde nickclyde released this 01 Jul 19:53
v0.5.0
8992977
This commit was signed with the committer’s verified signature.
nickclyde Nick Clyde
GPG key ID: FD85BDEF96540B65
Verified
Learn about vigilant mode.

Highlights

This release restores web search (which DuckDuckGo had started silently blocking) and hardens fetch_content against SSRF.

🔍 Search works again (#46, #50)

html.duckduckgo.com began blocking the default httpx client by TLS fingerprint, returning an empty HTTP 202 that silently parsed to zero results. search now shares the same backend abstraction as fetch_content and defaults to auto: it tries httpx first and falls back to curl_cffi Chrome TLS impersonation when it detects a block (HTTP 202/403).

  • New --search-backend flag and DDG_SEARCH_BACKEND env var (auto (default) / httpx / curl).
  • The curl/auto fallback needs the optional [browser] extra: pip install "duckduckgo-mcp-server[browser]". Without it, search degrades gracefully with a clear hint.

🔒 SSRF protection in fetch_content (#48, #51)

fetch_content no longer forwards arbitrary URLs into the network unchecked. By default it refuses targets that resolve to loopback, private (RFC1918), link-local (incl. the 169.254.169.254 cloud metadata endpoint), reserved, multicast, or unspecified addresses, allows only http/https, and re-validates every redirect hop.

⚠️ Behavior change: if you relied on fetch_content reaching localhost or internal hosts, set DDG_ALLOW_PRIVATE_URLS=1 (or pass --allow-private-urls) to opt back in for trusted deployments.

A new SECURITY.md documents the security model and a private vulnerability-reporting path.

Upgrade

uv pip install --upgrade duckduckgo-mcp-server
# or, to enable the search/fetch curl fallback:
uv pip install --upgrade "duckduckgo-mcp-server[browser]"

Full changelog: v0.4.0...v0.5.0

Assets 2
Loading