The advisory privacy concern is supported only as a documentation omission: there is no explicit privacy warning, but Tavily is clearly identified as the provider. Runtime requests contain supplied search parameters and URLs, with no broad local collection.

The package declares a compiled plugin entry and standard dependencies, with no install scripts or downloaded executables.

Instructions cover tool selection and research workflows without requesting unrelated access, automatic sensitive-data collection, or changes to agent authority.

The plugin uses its configured Tavily key, in-memory caches with TTL handling, and request timeouts. No filesystem writes, background workers, session-store access, or privilege escalation appear in the inspected runtime.

The registered search and extraction tools match the documented purpose and send supplied queries and URLs to Tavily by default.