search_outputs
[SUPPORT] a0e9133e — READ-ONLY full-text search over a run's OUTPUTS tree (numeric/tabular/array artifacts), backed by DuckDB native FTS (Okapi BM25). Walks outputs_dir recursively and builds a persistent index: each .csv/.json contributes its extracted TEXT content plus a cheap fingerprint (CSV ...
This record as markdown: /tools/io-github-ajc3xc-meridian/search-outputs.md
What search_outputs does on Meridian
AI agents call search_outputs to retrieve information from Meridian without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
| Parameter | Type | Required | Description |
|---|---|---|---|
limit | integer | — | Max ranked hits to return (default 10). |
query | string | Yes | The BM25 query — one or more search terms (column names, keys, script names, or any text in a csv/json). |
max_seconds | number | — | Wall-clock budget (seconds) for this call's incremental indexing before returning. Omit for the library default. Lower it for a faster first response on a huge |
outputs_dir | string | Yes | Absolute path to the outputs directory tree to index and search (walked recursively). |
include_archival | boolean | — | Default true — archival copies are deprioritized but still returned. Set false to exclude confirmed-archival files entirely. |
Parameters from the server's own tool schema.
Why search_outputs is rated Low
This is a read-only search tool that indexes and queries existing output artifacts using full-text search. It retrieves data without any side effects, modifications, or irreversible actions. The explicit '[SUPPORT]' and 'READ-ONLY' designations confirm the read-only nature.
From the tool's definition Tool name: search_outputs; description states '[SUPPORT] a0e9133e — READ-ONLY full-text search over a run's OUTPUTS tree'; 'Walks outputs_dir recursively and builds a persistent index'; 'ranked hits are returned'.
Attacks that exploit this kind of access
The rule that runs search_outputs safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Meridian, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For search_outputs, this is the rule to start with:
search_outputs is read-only, so it stays allowed. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Meridian, apply this rule, and every search_outputs call is checked against it from then on.
Questions about search_outputs
[SUPPORT] a0e9133e — READ-ONLY full-text search over a run's OUTPUTS tree (numeric/tabular/array artifacts), backed by DuckDB native FTS (Okapi BM25). Walks outputs_dir recursively and builds a persistent index: each .csv/.json contributes its extracted TEXT content plus a cheap fingerprint (CSV column names / JSON top-level keys / an inferred generating_script); each .npy contributes METADATA ONLY (never array content); images/other binaries contribute filesystem metadata + name only. The multi-word query is scored with BM25 and ranked hits are returned. Canonical-vs-archival is handled TWO-STAGE and is NEVER destructive: a filename heuristic (_old / _old_N / leading underscore) flags a CANDIDATE, and a SHA-256 content hash CONFIRMS — an archival copy byte-identical to its canonical twin is DEPRIORITIZED in ranking (is_archival=true, canonical_path set), while a same-name-pattern file whose content DIFFERS is surfaced as its own distinct hit (never collapsed). Nothing is ever deleted or hidden from disk. Pass include_archival=false to drop archival hits entirely. Returns {outputs_dir, query, total_indexed, hits:[{path, score, bm25, is_archival, canonical_path, kind, generating_script, csv_columns, json_keys, size, mtime, annotations:[{path, note, run_params, created_at, updated_at, source}]}]}. annotations is auto-included for each hit (any annotation keyed to the hit path OR a nearest ancestor directory) — no second tool call needed. A missing dir / empty tree returns an empty hits list, never an error. 3535b9ad — pass max_seconds to raise/lower the indexing budget (the "indexing slider"): a large or cold tree may not fully converge within the default budget on the first call — the result's partial=true field signals more indexing remains; call again to continue (each call resumes where the last left off, never restarts). It is categorised as a Read tool in the Meridian MCP Server, which means it retrieves data without modifying state.
search_outputs accepts 5 parameters: limit, query, max_seconds, outputs_dir, include_archival. Required: query, outputs_dir. The full parameter table on this page comes from the server's own tool schema.
Register the Meridian MCP server in PolicyLayer and add a rule for search_outputs: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Meridian. Nothing to install.
search_outputs is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the search_outputs rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for search_outputs. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
search_outputs is provided by the Meridian MCP server (@meridianmcp/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Meridian, and thousands of servers like it.
This server
Across the catalogue