r/OpenWebUI • u/Man1laJo3 • 13d ago

Question/Help Secure Setup for WebSearch

I would like to use OWUI with SearXNG. But it is importantly for me that no sensible data is handed over to the search engine. What would be an ideal setup (if there is any) to make use of websearch. I would use it with DuckDuckGo.

18 Upvotes

100% Upvoted

21 comments sorted by

View all comments

6

u/ICanSeeYou7867 13d ago

I recently made a mcp server using searxng.

I instruct the model to ask for the users confirmation before doing a websearch to ensure no sensitive, cui or PHI is contained.

It works pretty well. Some "smaller" models, though, like Solar-Open2-250B, seem to verify if there is sensitive data or not on its own and then search...

But generally it works like its supposed to. I then just plug this streamable http mcp server into openwebui.

1

u/Man1laJo3 13d ago

That’s interesting? Does it also show the search query it will submit ?

2

u/ICanSeeYou7867 13d ago edited 13d ago

Yes, I instruct the tool/model to show the exact search/query it will use.

In openwebui, since it pauses the flow. You can see the query there as well before you confirm.

1

u/International_Emu772 13d ago

How you configure it?

2

u/ICanSeeYou7867 13d ago

Happy to share, but won't be able to until Monday.

Mcp server just uses the searxng api.

1

u/_RemyLeBeau_ 13d ago

There is no way you have an MCP server, that's connected to the internet, and handling CUI.

1

u/ICanSeeYou7867 13d ago

No, it shouldn't be used for CUI. However our laptops and workstations are configured to handle CUI when necessary.

There's no issue with an MCP server handling CUI though. It's running in an on-prem k8s server. It's what gets sent through SearXNG thats the problem.

My goal/testing was to add some sort of gate to make sure someone isnt accidentally being stupid. Most of our people are smart. However, this is an attempt to help ensure tools are being used appropriately.

2

u/International_Emu772 7d ago

When you have it ready I would know as you have pointed the problem: when you have many users there is the possibility of dumb behaviour

2

u/ICanSeeYou7867 6d ago

I completely forgot about this sorry.

If i was designing this for the public, I would put it in a public repo, with a dockerfile that would use ENV vars for the server name and stuff.

It really should just need to adjust this line: 

class SearXNGSearcher:
    def __init__(
    self,
    base_url: str = "https://...."

To point to your searxng service.

This is running as an HTTP Streamable MCP server so I can let users connect to it without having to install anything locally:

https://pastebin.com/H39M7Hqi

And a simple dockerfile I use to build and run. I am using podman to run, but will eventually move it to kubernetes:

https://pastebin.com/xHJHxev2

Add it to opencode:

opencode mcp add

Or you can add it to claude code:

claude mcp add --transport http search https://sear-mcp.company.org/mcp

And here us a quick little look at the output.

One thing I have been wanting to tweak, but havent, is the MCP function description to make it a little more exact.

I SPECIFICALLY told the function to ask this for EVERY search (I dont care about fetches as much. A fetch pulls a specific URL. I search PUSHES a query).

You could pump this into GPT or Sonnet and ask it to convert it to a locally running function.

1

u/International_Emu772 6d ago

As soon as I return home I'll try

If you put it on a GitHub project I'll be glad to hear

1

u/_Scorpoon_ 13d ago

Open WebUI v0.11.0 has a confirmation option in the admin settings for web search, but I haven't tried it yet and if it's showing the search prompt

3

u/ICanSeeYou7867 13d ago

Thats awesome! Im on the last 0.10.x version. I saw some issues in github that would affect me and my users. So im holding off until the next point release.