Quick Configuration
Choose the setup that matches your environment.
Before You Start
- Confirm you have the account, endpoint, or API key required for Exa.
- Start with minimum scopes and read-only access where possible.
- Keep secrets in environment variables instead of hardcoding them in JSON.
npx -y exa-mcp-serverLocal config
JSON{
"exa": {
"command": "npx",
"args": ["-y", "exa-mcp-server"],
"env": {
"EXA_API_KEY": "${EXA_API_KEY}"
}
}
}After copying
Check the Exa JSON before running it in OpenClaw, then verify the server with a real prompt.
Verify prompt
Search for "Model Context Protocol specification" and return the top 3 sources with URLs.
Expected success output
You should see ranked results with titles, URLs, and snippets from Exa.
Common Pitfalls & Fixes
- ⚠️ Watch out: Choosing the right search mode and controlling result quality/recency.
- 🔑 Always store API keys in environment variables, never hardcode them in JSON.
- 🛡️ Start with read-only scopes if available to verify connection safely.
Security checklist
- Keep EXA_API_KEY in an environment variable, not in committed JSON.
- Treat returned pages as untrusted web content and verify citations before acting.
- Never paste EXA_API_KEY into chat, screenshots, or public review requests.
- Add .env and any file containing secrets to .gitignore before committing.
Common errors
EXA_API_KEY
Keep EXA_API_KEY in an environment variable or .env file, and confirm the OpenClaw process can read it.
.env safety
Add .env to .gitignore and never expose real keys in JSON config, logs, screenshots, or public review requests.
401/403
401 usually means a missing or invalid key; 403 usually means scopes, quota, or plan limits. Check the env var first, then the Exa dashboard.
| Error | Cause | Fix |
|---|---|---|
401 Unauthorized | EXA_API_KEY is missing or invalid. | Create an Exa API key at exa.ai and expose it as EXA_API_KEY before starting OpenClaw. |
Rate limit exceeded | The free quota or current plan limit was reached. | Reduce repeated searches, wait for reset, or upgrade the Exa plan. |
No results | The query was too narrow or used the wrong search mode. | Broaden the query and let Exa choose neural vs keyword search. |
EXA_API_KEY exposed in git | The API key was hardcoded into a committed config file or pasted into a public repo. | Move EXA_API_KEY to a .env file or shell export, add .env to .gitignore, and rotate the key if it was exposed. |
env not loaded | OpenClaw was started in a shell that does not have EXA_API_KEY set. | Export EXA_API_KEY in the same shell before launching OpenClaw, or use a dotenv loader that your host supports. |
Example Prompts
Once connected, try these prompts to test capabilities:
- Search for the latest MCP best practices and summarize the top 3 sources with links.
- Find an official spec or reference for Model Context Protocol and extract key points.
- Collect 5 credible sources about secure MCP configuration and synthesize recommendations.
Verification Checklist
- Run 1-2 real prompts to confirm Exa returns usable data.
- Check that error messages are clear enough for troubleshooting.
- Document the required scopes, dependencies, and env vars for future reuse.
FAQ
Where should I put EXA_API_KEY?
In an environment variable or .env file. Never hardcode it into JSON config or commit it to git.
How do I safely use a .env file?
Add .env to .gitignore. Do not expose the key in chat, screenshots, or public review requests.
How do I troubleshoot 401/403 errors?
401 usually means the key is missing or invalid; 403 may be a permission or plan limit. Confirm EXA_API_KEY is exported and check your quota in the Exa dashboard.