Your AI assistant now reads arXiv, with a poison-paper warning label

What it does

This is a Model Context Protocol (MCP) server that bridges AI assistants to arXiv. It exposes tools for searching papers with category and date filters, downloading them (HTML first, PDF fallback), and reading them back in chunked pages. Downloaded papers live in local storage, so repeated access is faster than hitting arXiv’s 3-second rate limit every time.

The interesting bit

The README spends as much space on security warnings as on features. It explicitly flags that arXiv papers are untrusted user-generated content and could contain prompt-injection attacks designed to hijack the AI reading them. The mitigations are practical—read-only MCP configs, human review of AI summaries, and caution about chaining this with filesystem or shell tools—not the usual security theater.

Key highlights

• Searches arXiv with boolean queries, category filters, and date ranges; auto-throttles to respect arXiv’s rate limits
• Downloads papers by ID, prefers HTML, falls back to PDF via pymupdf4llm (requires [pdf] extra)
• Returns chunked responses with content_length, returned_chars, next_start, and is_truncated so large papers don’t get silently truncated
• Supports both stdio and Streamable HTTP transports; includes DNS rebinding protection for HTTP mode
• Bundled as a .mcpb one-click install for Claude Desktop on macOS, plus Smithery, VS Code, Kiro, and Codex plugin manifests

Caveats

• PDF support is an optional extra; without it, older papers that lack HTML versions won’t download
• The security model assumes you don’t blindly trust AI-generated summaries of papers—human review is explicitly required
• HTTP transport defaults to localhost binding; exposing it requires manual ALLOWED_HOSTS/ALLOWED_ORIGINS configuration

Verdict

Worth a look if you want your AI assistant to do actual literature review without copy-pasting abstracts. Skip it if you need deep citation graph analysis or trust LLMs to autonomously evaluate research integrity.