I would do ashx in a situation like this. From your description, it sounds like a single search facility, a single table (or limited group of tables in a single database) and a relatively limited scope. All the MVC stuff is probably overkill. Don't over-engineer it.
Just create a class that implements IHttpHandler (or just do a generic handler if you're in Visual Studio 2005 or higher), parse the query string, either create a dynamic SQL string or pass the parameters to a stored procedure, and then use an XmlTextWriter to create the output. You can point the XmlTextWriter either to the output stream of the response or to a memory stream. I use the memory stream approach because it gives me better error handling options. Then set the content type to application/xml and stream the results.
I like this approach because it's easy to understand, easy to implement, easy to maintain, and gives you complete control. The downsides are that it's tightly bound to the database and may be less flexible than one of the web service framework based approaches if your application's scope increases over time.