arxiv-mcp

The server uses the `arxiv` library to fetch paper metadata and URLs, and `urllib.request.urlretrieve` to download PDFs. PDF text extraction is handled by `pymupdf` (fitz). Potential security considerations include vulnerabilities in `pymupdf` when processing malformed PDFs (a common risk with any PDF parser) and the `download_paper` tool's `target_dir` parameter. While this parameter is for a specific tool and intended functionality, it could allow a malicious client to attempt to write files to arbitrary locations if not properly validated or sandboxed by the client-side system. The server's internal storage (`get_paper` tool) uses a controlled directory. No direct 'eval' calls, obfuscation, or hardcoded secrets were found in the provided source code. File path sanitization (`paper_id.replace('/', '_')`) is applied for local storage management.