annas-mcp
MCP server and CLI tool for searching and downloading documents from Anna's Archive
No outside reports on file
This tool downloads files from the internet and runs them locally, which carries typical malware and legal risks; only use it for documents you have permission to access.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (iosifache/annas-mcp)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/iosifache/annas-mcp ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Annas MCP
This tool lets you search for and download books, papers, and other documents from Anna's Archive (a library website). It works as both a command-line program and as an MCP connector that AI assistants can use to find documents.
Who it’s for
Researchers, students, or developers who want to access library content through automation. People using Claude Desktop or other AI systems who want document search built in.
Alternatives
- Semantic Scholar API: Official academic paper search tool
- Open Library API: Legitimate book lookup and borrowing service
- arXiv API: Direct access to preprints of research papers
- Google Scholar: Search engine for academic papers and citations
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation steps, which likely involve cloning the repository and installing dependencies. Configuration typically requires adding the MCP server details to your AI assistant's settings.
Why this grade
Signal-based grade (4/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.1k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Access to external websites: The tool connects to Anna's Archive and downloads files from the internet, which could be blocked by your network or terms of service
- File download risks: Downloaded files could contain malware, viruses, or exploits hidden inside PDFs or documents
- Legal concerns: Some documents on archive sites may be copyrighted; downloading them could violate laws in your country
- URL injection: An AI could be tricked into searching for malicious queries or downloading from fake archive mirrors if the tool doesn't validate URLs carefully
- Data leakage: Your search history and downloaded file names could reveal what you're researching to network observers
How to lower the risk
Least-privilege permissions
- Run the tool in a sandboxed environment or restricted user account if possible
- Limit which queries the AI assistant can make to the archive
Network isolation
- Use a firewall rule to restrict outbound connections to known archive domains
- Consider running it on a separate machine or container
Monitoring
- Log all search queries and downloads to track what the AI is accessing
- Watch for unusual file types or sizes being downloaded
Red flags to watch for
- Unexpected network traffic to unfamiliar domains
- Downloads of executable files or suspicious document types
- AI attempting searches with odd keywords or encoded text
Questions
How do I install Annas MCP?
Annas MCP does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/iosifache/annas-mcp.
Are there security reports about Annas MCP?
No reports found for this package in our research (last checked 2026-10-30). Annas MCP currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include access to external websites, file download risks, legal concerns.
Is Annas MCP actively maintained?
Annas MCP has 1.1k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/iosifache/annas-mcp before pinning it in production.
What are alternatives to Annas MCP?
Notable alternatives to Annas MCP include Semantic Scholar API (Official academic paper search tool), Open Library API (Legitimate book lookup and borrowing service), arXiv API (Direct access to preprints of research papers), Google Scholar (Search engine for academic papers and citations). You can also compare Annas MCP side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Annas MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/iosifache-annas-mcp)HTML embed:
<a href="https://agentarmorhq.com/skills/iosifache-annas-mcp"><img src="https://agentarmorhq.com/api/badge/iosifache-annas-mcp" alt="AgentArmorHQ Risk Grade for Annas MCP" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "iosifache-annas-mcp"Share with your security lead
Need sign-off to use annas-mcp? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: annas-mcp
- **Listing URL:** https://agentarmorhq.com/skills/iosifache-annas-mcp
- **Type:** App connector
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.1k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** GitHub (iosifache/annas-mcp)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/iosifache/annas-mcp
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- iosifache
- Source code
- github.com/iosifache/annas-mcp
- Est. context load
- ~500 tokens / turn (~3 tool schemas, 0.25% of 200k context)
- Popularity
- 1.1k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-21
Community
Discussions for Annas MCP
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude