Exa

Read access to the web and to partner data reaches an agent as tools: search, contents, answer, monitors and the Exa Agent. Exa Connect adds partner sources inside an Agent run, among them Fiber.ai, Similarweb, Baselayer and Polymarket, with Exa handling the provider authentication. Everything it connects to is read; it takes no action in another system and holds no per user credentials for one.

Sourceexa.ai/llms.txtread 2026-09-22

Inside an Exa Agent run, the agent orchestrates its own tool calls, fanning out searches, splitting list building into parallel subtasks and verifying candidates, but that pipeline is Exa's own ready-made agent. The customer supplies a query, an output schema, an effort level and data sources, and cannot define, branch or sequence the steps.

The Batch API queues many requests to run asynchronously, which is job queueing rather than workflow logic. No workflow runtime lets the customer sequence, branch, retry or route work while mixing deterministic nodes with agent steps; the customer's own logic lives in its framework.

Sourceexa.ai/docs/agent/quickstartread 2026-09-22

The index Exa searches is its own, built from the public web plus select partner data (people, company and scholarly indexes, and premium providers reached through Exa Connect); none of it is the customer's own documents. Nothing lets a customer add its own documents to a structure Exa maintains and queries. Websets imports take a CSV of entities to enrich and filter, which is list data for a research job rather than a knowledge corpus, and the Enterprise plan's custom, tailored indexes are named on the pricing page without saying whose content they hold.

Sourceexa.ai/docs/search/data/overviewread 2026-09-22

Nothing here waits for a person's approval: Exa's agent reads the web and returns data, and takes no action in another system that someone would need to approve. What exists are job controls: an Agent run can be stopped, keeping the results gathered so far, or canceled, and a scheduled monitor can be paused, which stops its automatic runs.

Stopping a run ends it rather than holding it for someone to review, and pausing a monitor halts a schedule rather than an agent's work in progress, so neither is an approval or checkpoint on what the agent does. No approval step, consent checkpoint, escalation rule, guardrail or policy constraint is documented, and no run waits for a person.

Sourceexa.ai/docs/monitors/quickstartread 2026-09-22

Exa states it is SOC 2 Type II certified and publishes its SOC 2 reports and Data Processing Agreement through its Trust Center at trust.exa.ai.

The customer-facing controls are documented beside it: the Enterprise plan carries SSO and SCIM for the Exa Dashboard and Zero Data Retention enabled per team; an Exa organization with SSO and directory sync can let Claude reach Exa's MCP server through Okta, so removing a person in Okta ends their access; team admins invite members, and a Team Management API creates, rate limits and deletes API keys. HIPAA mode with a BAA is available on Enterprise for eligible cached retrieval.

Sourceexa.ai/docs/admin/security/overviewread 2026-09-22

A record of what the agent did is kept: completed Agent runs are stored with their answer, structured output, citations for each field and a cost breakdown, and can be listed and retrieved later; each monitor keeps a run history with every run's output and any failure reason; and the Team Management API reports usage and cost per API key.

While a run streams, its events carry search traces, sources and tool progress grouped by research step, but the stored events that can be replayed afterwards are, per Exa's OpenAPI specification, the run's lifecycle events.

Outputs and their sources are kept, but the step by step trace of prompts, tool calls and retrieved knowledge is not documented as retained, and no audit log, export to monitoring or SIEM systems, or retention period by plan is documented.

Sourceexa.ai/docs/agent/quickstartread 2026-09-22

An Exa Agent run can continue from an earlier one: previousRunId carries the earlier run's context into a follow-up request, such as asking for ten more results, and the team's stored runs can be listed, retrieved and deleted. That is context persisted across runs and read by the agent. Only continuation from run to run is documented: it is scoped to the team with no per user scope or editing, no retention period is stated, and it is switched off under Zero Data Retention. A monitor's record of results it has already returned is applied as a deduplication rule rather than read as context.

Sourceexa.ai/docs/agent/quickstartread 2026-09-22

Delivery is a hosted API. Exa's security overview describes regional access only as blocking requests from sanctioned countries, and no region choice, dedicated or private cloud, self-hosted or on-premises option appears in its documentation or on its pricing page. Zero Data Retention controls how long request data is kept, not where the service runs. Nothing documented lets a customer pin model traffic or data storage to specific regions or infrastructure.

Sourceexa.ai/docs/admin/security/overviewread 2026-09-22

The prebuilt piece is Exa Agent, which builds lists, enriches entities and runs deep research, returning cited output validated against the customer's schema, and it is also offered in Slack and Google Sheets. Exa publishes Agent Skills for coding agents (Build with Exa, Search and Contents) and example Agent configurations for list building, KYB and job postings. These are vendor-made working assets for one job, research over web and partner data. Beyond one research agent and three skills, there is no browsable catalog of workflows, templates or role specific agents a buyer adopts.

Sourceexa.ai/docs/agent/quickstartread 2026-09-22

Monitors run an Exa search on a schedule the customer sets, from hourly upward, then drop results already returned, synthesize the new findings and post them to the customer's webhook with a signed payload; a monitor can also be triggered on demand, and Websets monitors keep a dataset refreshed on their own schedule. Work starts on a schedule with no person initiating it. Exa also answers when someone tags @Exa in Slack, a conversational trigger. It does not subscribe to events in other systems.

Sourceexa.ai/docs/monitors/quickstartread 2026-09-22

Whatever model the customer's agent runs can take Exa's web data: its documentation covers OpenAI and Anthropic tool calling, the Vercel AI SDK and AI Gateway, OpenRouter, where it grounds any OpenRouter model, open models on Baseten, LangChain, LlamaIndex, CrewAI and Pydantic AI, and any MCP client can connect. Only Exa's own Agent, Answer and page summaries run on models Exa chooses. Model choice for the customer's agent stays with the customer.

Sourceexa.ai/docs/llms.txtread 2026-09-22

Developers call Exa through a documented REST API with published OpenAPI specifications (search, contents, answer, monitors, batches, the Agent API, and a Team Management API for keys), official Python and JavaScript SDKs, an endpoint compatible with the OpenAI SDK for chat completions and the Responses API, a hosted MCP server with OAuth, and Agent Skills for coding agents.

Sourceexa.ai/llms.txtread 2026-09-22

Exa publishes evaluations and open-source benchmarks of its own search quality, latency and research performance, which describe Exa's product rather than the customer's agent. No fixtures, test datasets, scoring or quality gates for the customer's agent workflows are documented; citations and confidence on Exa's output let a builder check sources, which is not testing.

Sourceexa.ai/llms.txtread 2026-09-22

Exa's Contents API extracts clean content from any URL, including pages rendered with JavaScript, PDFs and complex layouts, and fetches live when the indexed copy is older than the caller allows; its crawler reads the public web while respecting robots rules and does not bypass logins, paywalls or CAPTCHAs. Reading and rendering pages that have no API amounts to scraping and a headless fetch. No interactive control of a browser or computer (clicking, typing, filling forms or operating a logged in session) is documented.

Sourceexa.ai/llms.txtread 2026-09-22