B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · Developer tools, Files & documents

PDFMathTranslate

[EMNLP 2025 Demo] PDF scientific paper translation with preserved formats - 基于 AI 完整保留排版的 PDF 文档全文双语翻译，支持 Google/DeepL/Ollama/OpenAI 等服务，提供 CLI/GUI/MCP/Docker/Zotero

Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity score: 51/100
Rank: #109 of 500
GitHub stars: 37.6k

What it does

PDFMathTranslate translates scientific papers in PDF format while preserving layout, formatting, and mathematical equations. It supports multiple translation backends (Google Translate, DeepL, Ollama, OpenAI) and can be deployed as a CLI tool, GUI application, MCP server, Docker container, or Zotero plugin.

Who it’s for

Researchers, academics, and organizations that need to translate scientific literature across language barriers while maintaining document fidelity. Builders integrating translation capabilities into research workflows or knowledge management systems.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Verify against the repo README at https://github.com/PDFMathTranslate/PDFMathTranslate (opens external site) for current instructions. Likely approaches include:

bash

# CLI installation (example—verify in repo)
pip install PDFMathTranslate

# For MCP server mode, add to Claude Desktop config (~/.config/Claude/claude_desktop_config.json):
{
  "mcpServers": {
    "pdfmathtranslate": {
      "command": "python",
      "args": ["-m", "pdfmathtranslate.mcp"]
    }
  }
}

Requires API credentials for chosen translation service (Google, DeepL, OpenAI, etc.).

Risks

Credential exposure: API keys for translation services (OpenAI, DeepL, Google) must be securely stored; misconfiguration could leak credentials to logs or process memory.
Data exfiltration: PDFs sent to third-party translation APIs (especially closed-source services) may be retained or logged by providers; sensitive research could be exposed.
Prompt injection: Malformed PDF content or embedded scripts could potentially manipulate translation behavior or extract unintended data if not sanitized.
Supply-chain risk: Dependencies on multiple external translation services; outages or changes to their APIs could break workflows.
Insufficient audit trail: Limited visibility into how/where documents are processed, especially across Docker or Zotero integrations.

How to stay secure

Least-privilege permissions

Run the MCP connector in a dedicated, unprivileged container or process; isolate file system access to only required input/output directories.
Store API credentials in environment variables or secrets management tools (e.g., HashiCorp Vault, AWS Secrets Manager); never embed in code or config files.
Restrict Zotero integration permissions to read-only access for PDFs; disable write access to metadata or library unless explicitly required.
Apply principle of least privilege for Docker volumes—mount PDFs as read-only and use separate writable volumes for translated output only.

Network isolation

Route all API requests through a corporate proxy or VPN to monitor and log outbound translation service calls.
Use network policies (Kubernetes NetworkPolicy, Docker networks) to prevent the connector from initiating unexpected outbound connections.
Disable or strictly control internet access to translation services for highly sensitive documents; consider air-gapped or on-premises alternatives (Ollama, local models).
Implement certificate pinning or mTLS for API communication to prevent man-in-the-middle attacks.

Monitoring

Log all document processing events (file name, size, target service, timestamp) to a centralized immutable audit log; exclude API key values.
Monitor API rate limits and quota usage for each translation service to detect anomalous activity or unauthorized submissions.
Implement file integrity monitoring (FIM) on input and output directories to detect unauthorized modifications or exfiltration attempts.
Track connector version and dependency versions; set up alerts for security patches from PDFMathTranslate and its dependencies.

Red flags to watch for

API keys appearing in application logs, error messages, or process memory dumps.
Unexpected outbound connections to IP addresses or domains outside known translation service endpoints.
Processing of PDFs significantly larger than expected, or submission to third-party services when on-premises mode (Ollama) is configured.
Failed authentication or rate-limiting errors that could indicate credential compromise or account abuse.

Alternatives

DeepL API (direct) – Native integration without format preservation; simpler but requires custom PDF handling.
Google Translate API (direct) – Similar trade-offs; widely adopted but no specialized PDF math support.
Ollama-based translation – Local, private alternative; requires self-hosting but eliminates cloud data exposure.
Overleaf + manual translation – Collaborative authoring platform; labor-intensive but maintains full control.

Sources

github.com/PDFMathTranslate/PDFMathTranslate