C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Data & databases, Web & browsing
arxiv-mcp-server
A local MCP server for agent literature work. Original-LaTeX section reads, BibTeX from arXiv metadata, and topic watches. Papers stay on disk. Search is optional.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 40/100
- Rank
- #341 of 500
- GitHub stars
- 3.2k
What it does
arxiv-mcp-server is a local MCP server that lets AI agents search, read, and organize academic papers from arXiv directly on your machine. It extracts BibTeX metadata, preserves original LaTeX, supports topic watches, and keeps all papers stored locally without requiring external API calls.
Who it’s for
Researchers, academics, and AI builders who want agents to autonomously discover and synthesize arXiv papers while maintaining full data privacy. Teams conducting literature reviews or building research-focused AI workflows.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Clone the repository and follow the setup instructions in the README at https://github.com/blazickjp/arxiv-mcp-server (opens external site). For Claude Desktop integration, add the server to your mcpServers configuration JSON (exact format should be verified against the repo README, as MCP server setup varies by tool). Typical node-based servers use npx or npm install locally.
Risks
- Local storage exposure: Papers downloaded to disk are vulnerable if the machine is compromised; no encryption mentioned for at-rest storage.
- Prompt injection via metadata: Malicious paper titles or abstracts from arXiv could be injected into agent prompts without sanitization.
- Supply-chain dependency: Relies on arXiv's availability and integrity; no signature verification of downloaded content evident.
- Unvetted search scope: No rate-limiting or query validation documented; agents could make excessive requests or be tricked into resource exhaustion.
- LaTeX parsing risks: Processing arbitrary LaTeX from papers could trigger code execution if the parser isn't sandboxed.
How to stay secure
Least-privilege permissions
- Run the arxiv-mcp-server with a dedicated user account that has read-only access to the papers folder and no admin rights on your machine.
- Restrict the account's network access to only communicate with arXiv servers; block all other outbound connections using your firewall.
- Limit which AI agents can connect to this server—only allow trusted applications to query it, not every tool or service on your network.
Network isolation
- Keep the arxiv-mcp-server on an air-gapped machine (physically separated network) or a dedicated virtual machine if possible, especially if papers contain sensitive research.
- Disable direct internet access from the server; if updates are needed, manually download and install them on a separate machine first.
- Use a VPN or private network between your AI agent and the server—never expose it to the public internet or untrusted networks.
Monitoring
- Log all search queries and paper downloads; review them weekly for unusual patterns like thousands of requests in minutes or searches for suspicious keywords.
- Set up disk space alerts—if storage fills unexpectedly, it may indicate an agent is downloading without limits or an attacker is abusing the service.
- Monitor CPU and network activity during paper processing; unusual spikes could mean malicious LaTeX is being executed or the system is under attack.
Red flags to watch for
- Papers with extremely long or garbled titles, unusual Unicode characters, or suspicious metadata that could be prompt injection attacks designed to trick your AI.
- Repeated failed connection attempts to arXiv or requests for the same paper over and over—signs of tampering or resource exhaustion.
- Unexpected processes running on your system or new files appearing outside the designated papers folder—possible indicators of code execution through LaTeX parsing.
Alternatives
- Semantic Scholar API – cloud-hosted academic search with more structured metadata; trades privacy for managed infrastructure.
- Papers with Code connector – bridges papers to implementation; better for reproducibility but requires external API.
- Local Ollama + embedding tools – roll-your-own knowledge base for papers; higher setup friction but maximum control.
- Zotero API bridge – integrates with Zotero libraries; better for existing research workflows but less agent-native.