C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Web & browsing
paper-search-mcp
MCP, CLI, Skills for searching and downloading academic papers from multiple sources like arXiv, PubMed, bioRxiv, etc.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 39/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 2.8k
What it does
paper-search-mcp enables AI agents to search and download academic papers from sources like arXiv, PubMed, and bioRxiv via MCP protocol, CLI, and skills interfaces. It integrates with Claude and other AI systems to programmatically access research literature without manual browsing.
Who it’s for
Researchers, AI builders, and executives automating literature reviews or building AI agents that need academic paper discovery. Teams wanting to augment Claude or other LLMs with access to academic databases.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Follow the setup steps in the project’s official README: https://github.com/openags/paper-search-mcp (opens external site)
Risks
- No visible access controls: The connector may allow agents to download unlimited papers without rate-limiting or quota enforcement, risking abuse of academic APIs.
- Data exfiltration potential: Downloaded papers and metadata could be stored, logged, or transmitted to unintended destinations depending on agent and system configuration.
- Third-party API dependency: Reliance on arXiv, PubMed, and bioRxiv APIs means upstream outages or ToS changes could break functionality; unclear credential/auth scoping.
- Prompt injection risk: User queries passed to paper searches could be manipulated by malicious inputs to alter search behavior or extract unintended data.
- Supply-chain opacity: Limited maintenance signals (0 weekly npm downloads) suggest low adoption; unclear update cadence or security patching responsiveness.
How to stay secure
Least-privilege permissions
- Limit API quotas: Configure maximum paper downloads per user/session (e.g., 50 papers/day) to prevent agents from exhausting academic APIs and triggering blocks or abuse bans.
- Restrict storage scope: Ensure downloaded papers are stored only in dedicated, isolated folders—not system directories or shared cloud storage where they could be accessed by other applications.
- Use read-only credentials: If possible, provide API keys with read-only access to search functions only, preventing accidental modification or deletion of data on third-party services.
- Require human approval for bulk downloads: Mandate manual review before agents execute searches returning >100 results to catch automated abuse attempts.
Network isolation
- Block external uploads: Configure firewalls to prevent downloaded papers from being sent to cloud services, email systems, or external URLs without explicit approval.
- Use internal proxies: Route all paper search requests through your organization's proxy or VPN to monitor traffic and prevent direct connections to academic APIs.
- Disable concurrent requests: Limit the connector to one search/download at a time to prevent rapid-fire API calls that mimic denial-of-service attacks.
- Segment API credentials: Store API keys for arXiv/PubMed separately from agent systems; rotate them every 90 days.
Monitoring
- Log all downloads: Record what papers were requested, by whom, when, and how many—flag unusual patterns (e.g., 500+ downloads in one hour).
- Track API failure rates: Monitor responses from third-party services; sudden blocks or errors may indicate abuse or upstream issues requiring pause of connector access.
- Alert on quota violations: Set automatic notifications when agents approach or exceed daily/weekly download limits.
- Audit search queries: Review actual search terms being submitted; unexpected keywords (data exfiltration, credentials, etc.) indicate prompt injection attempts.
Red flags to watch for
- Unmaintained code: Verify when the connector was last updated; packages without patches for >6 months pose security risks and should be deprioritized.
- Unexpected file sizes or counts: Sudden spikes in downloaded papers or unusually large metadata files suggest misconfiguration or compromise.
- Failed API authentication: Repeated credential errors or invalid token messages indicate potential exposure of API keys or supply-chain tampering.
- Queries containing sensitive terms: Search strings including internal project names, passwords, or PII suggest an agent has been manipulated by malicious user input.
Alternatives
- Semantic Scholar API – Direct API access to academic papers with better documentation and rate-limiting; requires separate API key management.
- LangChain ArxivQueryRun tool – LangChain's built-in arXiv integration; simpler but less feature-rich than dedicated MCP.
- Papers.With.Code integration – Focus on papers paired with code/models; narrower scope but curated academic-ML intersection.
- Custom API wrappers (Anthropic Libraries) – Build your own MCP connector with explicit auth and logging; higher setup cost but full control.