diff --git a/src/mcp/websearch.test.ts b/src/mcp/websearch.test.ts
index 707961670..87fb2dce4 100644
--- a/src/mcp/websearch.test.ts
+++ b/src/mcp/websearch.test.ts
@@ -54,3 +54,36 @@ describe("createWebsearchConfig Tavily handling", () => {
     expect(config?.url).toBe("https://mcp.tavily.com/mcp/")
   })
 })
+
+describe("createWebsearchConfig Exa handling", () => {
+  test("keeps EXA_API_KEY out of URL query params and sends bearer auth header", () => {
+    process.env.EXA_API_KEY = "exa-secret"
+
+    const config = createWebsearchConfig({ provider: "exa" })
+
+    expect(config).toEqual({
+      type: "remote",
+      url: "https://mcp.exa.ai/mcp?tools=web_search_exa",
+      enabled: true,
+      headers: {
+        Authorization: "Bearer exa-secret",
+      },
+      oauth: false,
+    })
+    expect(config?.url).not.toContain("exaApiKey")
+    expect(config?.headers).not.toHaveProperty("x-api-key")
+  })
+
+  test("uses unauthenticated Exa URL when EXA_API_KEY is missing", () => {
+    delete process.env.EXA_API_KEY
+
+    const config = createWebsearchConfig({ provider: "exa" })
+
+    expect(config).toEqual({
+      type: "remote",
+      url: "https://mcp.exa.ai/mcp?tools=web_search_exa",
+      enabled: true,
+      oauth: false,
+    })
+  })
+})
diff --git a/src/mcp/websearch.ts b/src/mcp/websearch.ts
index be3bad4b2..5417e8289 100644
--- a/src/mcp/websearch.ts
+++ b/src/mcp/websearch.ts
@@ -32,11 +32,9 @@ export function createWebsearchConfig(config?: WebsearchConfig): RemoteMcpConfig
 
   return {
     type: "remote" as const,
-    url: process.env.EXA_API_KEY
-      ? `https://mcp.exa.ai/mcp?tools=web_search_exa&exaApiKey=${encodeURIComponent(process.env.EXA_API_KEY)}`
-      : "https://mcp.exa.ai/mcp?tools=web_search_exa",
+    url: "https://mcp.exa.ai/mcp?tools=web_search_exa",
     enabled: true,
-    ...(process.env.EXA_API_KEY ? { headers: { "x-api-key": process.env.EXA_API_KEY } } : {}),
+    ...(process.env.EXA_API_KEY ? { headers: { Authorization: `Bearer ${process.env.EXA_API_KEY}` } } : {}),
     oauth: false as const,
   }
 }